Fake 'U.S. Copyright Office' Imposter Gets Google To Delist URLs On Section 1201 Grounds

from the fake-views dept

We've done more than our share of posts in the past about the problems within the DMCA takedown system as currently practiced. The reason for so many posts is in part due to the sheer number of problems with how this all works. For starters, when notices go out to search engines like Google to delist "problem" URLs, those notices are often times generated by automated systems that unsurprisingly result in a vast majority of notices targeting URLs that are non-infringing. As in, over 99% of those notices. And even once we get past the malpractice of using automation buckshot notices that result in an incredible amount of collateral damage, we then have to add the wide open avenues for fraud and abuse of the DMCA system. That type of fraud runs the gamut, from trolls merely trying to cause chaos for the fun of it to competitors of certain forms of content trying to hurt the competition. In the immortal words of former NFL coach John Fox: "It's all a problem."

And, on the fraud and abuse side, it's such a problem that perfectly legit URLs can get delisted by Google due to a request from "The U.S. Copyright Office", even though that office doesn't make those sorts of requests.

Google has received several takedown notices that claim to come from the 'U.S. Copyright Office', requesting the search engine to remove 'problematic' URLs. The Government body, which is generally not involved in copyright enforcement, informs TorrentFreak that it has nothing to do with these notices. Unfortunately, Google didn't immediately spot the imposter.  

The Copyright Office is not supposed to take sides in these matters. So, we were quite surprised to see its name on several takedown notices that were sent to Google over the past few days.

The takedown requests are not typical ‘Section 512’ notices. Instead, they point out sites that circumvent technical protection measures, which is in violation of the DMCA’s ‘Section 1201.’ That’s also how Google processed them.

And process at least some of them, Google did. The notices claiming to be from the Copyright Office indicated they were sent on behalf of the Video Industry Association of America, which doesn't appear to exist based on a Google search I performed. Even if it does, the Copyright Office is not a party to these sorts of takedown requests on behalf of any organization. The URLs targeted appear to be mostly related to stream-ripping sites, but not just sites that offer that service. Instead, some of the URLs targeted merely mention sites that offer stream-ripping services, which is how several TorrentFreak posts got targeted.

Whoever is doing this, it is most certainly not the Copyright Office.

This suspicion was confirmed by the U.S. Copyright Office. A spokesperson informs TorrentFreak that the notices in question were not submitted by them.

This doesn’t mean that the takedown requests were ignored by Google. While our links are still indexed, several of the URLs listed in the notices have indeed been removed because of the notices, which is a problem.

It's a huge problem, actually. In fact, it demonstrates quite well how broken the current DMCA system has become. The fact that this sort of impersonation is so easy is an issue. The fact that Google is so inundated with these types of requests, which again are overwhelmingly illegitimate, that it cannot review them thoroughly enough to notice the clear impersonation of the Copyright Office at work here is another issue. And the fact that the DMCA process is obviously viewed by some bad actors as a wide open tool to attack their own competition is yet another issue.

And, notably, there isn't even an appeal process for Section 1201 takedown requests.

Unfortunately, there is no counter-notification option for ‘Section 1201’ takedown notices. This means that sites and services that are affected by these bogus notices have no official appeal process they can use.

But perhaps the U.S. Copyright Office can help with that?

Or maybe someone can just pretend to be the Copyright Office and help. You know, on its "behalf." It works for the bad actors, after all.

Filed Under: circumvention, copyfraud, copyright abuse, dmca, dmca 1201, takedowns, us copyright office
Companies: google

GitHub, EFF Push Back Against RIAA, Reinstate Youtube-dl Repository

from the DEAR-RIAA-YOU-ARE-CORDIALLY-INVITED-TO-GFY dept

A few weeks ago, the RIAA hurled a DMCA takedown notice at an unlikely target: GitHub. The code site was ordered to take down its repositories of youtube-dl, software that allowed users to download local copies of video and audio hosted at YouTube and other sites.

The RIAA made some noise about copyright infringement (citing notes in the code pointing to Vevo videos uploaded by major labels) before getting down to business. This was a Section 1201 complaint -- one that claimed the software illegally circumvented copyright protection schemes applied to videos by YouTube.

The takedown notice demanded removal of the code, ignoring that fact there are plenty of non-infringing uses for a tool like this. It ignored Supreme Court precedent stating that tools with significant non-infringing uses cannot be considered de facto tools of infringement. It also ignored the reality of the internet: that targeting one code repository wouldn't erase anything from dozens of other sites hosting the same code or the fact that engaging in an overblown, unjustified takedown demand would only increase demand (and use) of the software.

Youtube-dl is a tool used by plenty of non-infringers. It isn't just for downloading Taylor Swift videos (to use one of the RIAA's examples). As Parker Higgins pointed out, plenty of journalists and accountability activists use the software to create local copies of videos so they can be examined in far more detail than YouTube's rudimentary tools allow.

John Bolger, a software developer and systems administrator who does freelance and data journalism, recounted the experience of reporting an award-winning investigation as the News Editor of the college paper the Hunter Envoy in 2012. In that story, the Envoy used video evidence to contradict official reports denying a police presence at an on-campus Occupy Wall Street protest.

“In order to reach my conclusions about the NYPD’s involvement... I had to watch this video hundreds of times—in slow motion, zoomed in, and looping over critical moments—in order to analyze the video I had to watch and manipulate it in ways that are just not possible” using the web interface. YouTube-dl is one effective method for downloading the video at the maximum possible resolution.

At the time, GitHub remained silent on the issue, suggesting it was beyond its control. Developers who'd worked on the youtube-dl project reported being hit with legal threats of their own from the RIAA.

There's finally some good news to report. The EFF has taken up GitHub/youtube-dl's case and is pushing back. A letter [PDF] from the EFF to GitHub's DMCA agent gets into the tech weeds to contradict the RIAA's baseless "circumvention" claims and the haphazard copyright infringement claims it threw in to muddy the waters.

First, youtube-dl does not infringe or encourage the infringement of any copyrighted works, and its references to copyrighted songs in its unit tests are a fair use. Nevertheless, youtube-dl’s maintainers are replacing these references.

Second, youtube-dl does not violate Section 1201 of the DMCA because it does not “circumvent” any technical protection measures on YouTube videos. Similarly, the “signature” or “rolling cipher” mechanism employed by YouTube does not prevent copying of videos.

There's far more in the letter, but this explains it pretty succinctly in layman's terms:

youtube-dl works the same way as a browser when it encounters the signature mechanism: it reads and interprets the JavaScript program sent by YouTube, derives the “signature” value, and sends that value back to YouTube to initiate the video stream. youtube-dl contains no password, key, or other secret knowledge that is required to access YouTube videos. It simply uses the same mechanism that YouTube presents to each and every user who views a video.

We presume that this “signature” code is what RIAA refers to as a “rolling cipher,” although YouTube’s JavaScript code does not contain this phrase. Regardless of what this mechanism is called, youtube-dl does not “circumvent” it as that term is defined in Section 1201(a) of the Digital Millennium Copyright Act, because YouTube provides the means of accessing these video streams to anyone who requests them. As a federal appeals court recently ruled, one does not “circumvent” an access control by using a publicly available password. Digital Drilling Data Systems, L.L.C. v. Petrolink Services, 965 F.3d 365, 372 (5th Cir. 2020). Circumvention is limited to actions that “descramble, decrypt, avoid, bypass, remove, deactivate or impair a technological measure,” without the authority of the copyright owner… Because youtube-dl simply uses the “signature” code provided by YouTube in the same manner as any browser, rather than bypassing or avoiding it, it does not circumvent, and any alleged lack of authorization from YouTube or the RIAA is irrelevant.

GitHub's post on the subject explains the situation more fully, breaking down what the site's obligations are under the DMCA and what it does to protect users from abuse of this law. It also states that its overhauling its response process to Section 1201 circumvention claims to provide even more protection for coders using the site. Going forward, takedown notices will be forwarded to GitHub's legal team and if there's any question about its legitimacy, GitHub will err on the side of USERS and leave the targeted repositories up until more facts are in. This puts it at odds with almost every major platform hosting third-party content which almost always err on the side of the complainant.

And the cherry on top is the establishment of a $1 million legal defense fund for developers by GitHub. This will assist developers in fighting back against bogus claims and give them access to legal advice and possible representation from the EFF and the Software Freedom Law Center.

Youtube-dl is back up. And the RIAA is now the one having to play defense. It will have to do better than its slapdash, precedent-ignoring, deliberately-confusing takedown notice to kill a tool that can be used as much for good as for infringement,

Filed Under: circumvention, copyright, copyright 1201, copyright 512, counternotice, recording software, takedowns, youtube-dl
Companies: eff, github, riaa, youtube

Despite RIAA's Claim That YouTube-dl Is Infringing, Journalists Use It All The Time

from the substantial-non-infringing-uses dept

A few weeks ago we had a story about the RIAA getting GitHub to remove YouTube-dl using a bizarre form of copyright takedown. The RIAA claimed that the tool violated rules against circumventing DRM. Over at Freedom of the Press Foundation, Parker Higgins has highlighted how often this tool is used legitimately for journalism purposes, which is important. Under the Betamax standard, tools with substantial non-infringing uses should not run afoul of copyright law. Higgins' writeup is reposted here with permission.

The popular free software project “YouTube-dl” was removed from GitHub following a legal notice from the Recording Industry Association of America claiming it violates U.S. copyright law. According to the RIAA, the tool's “clear purpose” includes reproducing and distributing “music videos and sound recordings... without authorization.”

In fact, YouTube-dl is a powerful general purpose media tool that allows users to make local copies of media from a very broad range of sites. That versatility has secured it a place in the toolkits of many reporters, newsroom developers, and archivists. For now, the code remains available to download through YouTube-dl's own site, but the disruption of its development hub and the RIAA saber-rattling jeopardizes both the future of the software and the myriad journalistic workflows that depend on it.

Numerous reporters told Freedom of the Press Foundation that they rely on YouTube-dl when reporting on extremist or controversial content. &Oslashyvind Bye Skille, a journalist who has used YouTube-dl at the Norwegian Broadcasting Corporation and as a fact checker with Faktisk.no, said, “I have also used it to secure a good quality copy of video content from YouTube, Twitter, etc., in case the content gets taken down when we start reporting on it.” Skille pointed to a specific instance of videos connected to the terrorist murder of a Norwegian woman in Morocco. “Downloading the content does not necessarily mean we will re-publish it, but it is often important to secure it for documentation and further internal investigations.”

Justin Ling, a freelance investigative reporter who often covers security and extremism for outlets including Foreign Policy and VICE News, described the scenario of reporting on the rise of conspiracy theories as the relevant posts face removal and bans. YouTube “has been a crucial hub for QAnon organizing and propaganda: I've often used YouTube-dl to store those videos for my own benefit. Good thing, too, as YouTube often, without warning, mass-removes that sort of content, which can be ruinous for those of us using those YouTube accounts to trace the spread of these conspiracies.”

In other cases, local copies are necessary to conduct more rigorous analysis than is possible online, and journalists turn to YouTube-dl for the highest quality copy of the video available. John Bolger, a software developer and systems administrator who does freelance and data journalism, recounted the experience of reporting an award-winning investigation as the News Editor of the college paper the Hunter Envoy in 2012. In that story, the Envoy used video evidence to contradict official reports denying a police presence at an on-campus Occupy Wall Street protest.

“In order to reach my conclusions about the NYPD’s involvement... I had to watch this video hundreds of times—in slow motion, zoomed in, and looping over critical moments—in order to analyze the video I had to watch and manipulate it in ways that are just not possible” using the web interface. YouTube-dl is one effective method for downloading the video at the maximum possible resolution.

Jake, a member of the Chicago-based transparency group Lucy Parsons Labs, uses YouTube-dl to save copies of recorded incidents involving police use of force or abusive behavior. Once copied, the videos can be stored in an archive or modified before publication, such as by blurring the faces of bystanders or victims. “We have sometimes been able to take a closer look at individual frames after downloading with YouTube-dl to identify officers when they are not wearing their badges intentionally or obfuscating them with things to avoid accountability.”

One misinformation researcher told Freedom of the Press Foundation about using YouTube-dl to create a baseline for machine learning models developed to do automated real-time fact-checking. “While our production systems are designed to be used on live video streams, it's not feasible to test on live video. YouTube-dl allows us to greatly increase the speed of our research development and allow us to be able to actually test our software on a day-to-day basis, not just when politicians happen to have a speech.”

Similarly, a number of reporters described using YouTube-dl for nuts-and-bolts workflows such as transcribing videos they’re covering. Jeremy Gray, a data scientist with The Globe and Mail, described a Slack tool he provides to journalists to allow them to automatically transcribe their own interviews and, until Friday, to transcribe YouTube videos from a URL. “It used YouTube-dl, and now that part is broken.” Another journalist, who works at a “small-ish public media newsroom,” described a common situation where a reporter needs “a recording of a public meeting for a story but is on deadline and doesn’t want the hassle of recording the parts they want it in real time or wants the full file for something like AI transcription.”

That same journalist described how YouTube-dl helps address the challenge of incorporating user-generated content on-air. In the immediate aftermath of an earthquake, their newsroom began expansive continuous coverage and sought to include photos and videos that locals had recorded. “We are scrupulous about making sure we get permission (and the person granting it actually owns the copyright), but especially right after an earthquake asking people to send the video to us specifically can be a much bigger ask than just allowing us to use it (if they even have a recording, which they probably don’t for a livestream), so often after getting permission I’d just download it straight from social media to transcode for TV.”

That use case is common. Reporters frequently need high-fidelity copies of video or audio tracks for publication or reporting. Ling, the freelance security reporter, said he also uses YouTube-dl to “get the best audio quality” when downloading copies of press conferences or news events “to grab snippets of audio for use in podcasts or radio work.”

Finally, numerous reporters described using YouTube-dl to download copies of their own works. Freedom of the Press Foundation has previously worked to help writers preserve portfolio copies of their articles, and to help full news archives stay online when the outlet itself is under threat. YouTube-dl plays an important role in that ecosystem as well.

GitHub has not publicly commented on its removal of one of its most popular repositories. Clearly, YouTube-dl in particular and the ability to download and manipulate online videos in general are an important part of the work of journalism and contemporary media literacy. Given the important role that YouTube-dl plays in public interest reporting and archiving, the RIAA’s efforts to have the tool removed represent an extraordinary overreach with the possibility for dramatic unforeseen consequences. We urge RIAA to reconsider its threat, and GitHub to reinstate the account in full.

Filed Under: circumvention, copyright, dmca 1201, downloads, journalism, non-infringing uses, youtube-dl
Companies: riaa, youtube

Copyright Office Extends Anti-Circumvention DMCA Exemptions To All Filmmakers, Not Just Documentarians

from the victory dept

Earlier this year, we wrote a bunch of posts on the Copyright Office's request for comment on changes needed to the DMCA's anti-circumvention exemption list. There were lots of interesting submissions, but one that caught my attention was a whole bunch of film association groups, most of them for documentarians, advocating that the anti-circumvention they enjoyed to be able to use clips from other films and content be expanded to include filmmakers generally. This would address the copyright industries' cynical attempt to route around Fair Use usage by filmmakers by simply locking up their content behind all kinds of DRM that, unless you're a documentarian, you can't circumvent. The MPAA, as you would expect, said that allowing for this would kick off "widespread hacking" of all the DVDs on the planet, while all it was really concerned about was the licensing agreements it was able to secure by filmmakers who didn't want to violate the DMCA to get the Fair Use clips they wanted.

Well, the Copyright Office made its decision and the exemption will now be offered to filmmakers en masse.

Digital Millennium Copyright Act (DMCA) exemptions aren’t just for documentary filmmakers any more. The U.S. Copyright Office and Library of Congress last week broadened a DMCA exception to now allow more filmmakers to circumvent anti-copying technology and rip short video clips for purposes of commentary and criticism.

“This is huge for the independent film industry,” said Michael Donaldson, an attorney who argued for expanding the exemption before the Copyright Office, in a written statement. “The use of fair use material by narrative filmmakers has exponentially increased to the point where expanding the exemption to fiction films was absolutely necessary.”

What this means is that more filmmakers will now be able to simply rip clips from protected DVDs to use in their own creative works, as long as the purpose of the clip is used for parody or to demonstrate biographical or historically significant information. This opens up all kinds of uses, of course, but all of them will still be subject to being truly Fair Use cases. That, of course, is a defense, so you can expect lawsuits to be filed before we settle into some kind of a norm here.

Still, this is a good decision by the Copyright Office. The idea that the MPAA and others could lock up content that could otherwise be fairly used behind DRM obviously doesn't comport with the purpose of the law.

Filed Under: circumvention, copyright, copyright office, dmca, dmca exemptions, drm, fair use, filmmakers, library of congress, parody, triennial review

Farmer Lobbying Group Accused Of Selling Out Farmers On Right To Repair Laws

from the do-not-pass-go,-do-not-collect-$200 dept

For the last few years, numerous states have been pushing so-called "right to repair" bills, which would make it easier for consumers to repair their own products and find replacement parts and tools. Not surprisingly, many tech companies have been working overtime to kill these efforts including Apple, which has tried to argue that Nebraska's right to repair bill would turn the state into a nefarious playground for hackers. Opposition also includes Sony and Microsoft, both of which enjoy a repair monopoly on their respective video game consoles.

Whether coming from Apple, Sony, or Microsoft, opposition to these bills usually focuses on the three (false) ideas: the bills will make users less safe, somehow "compromise" intellectual property, and open the door to cybersecurity theft.

Much of the current right to repair fracas began with the lowly tractor. More specifically, it started when John Deere decided to ban anything but "unauthorized repairs," inadvertently turning countless ordinary citizens into technology policy activists. A lengthy EULA the company required customers to sign back in 2016 forbids the lion-share of repair or modification of tractors customers thought they owned, simultaneously banning these consumers from suing over "crop loss, lost profits, loss of goodwill, loss of use of equipment … arising from the performance or non-performance of any aspect of the software."

As ordinary farmers hack their way around these restrictions just to make a living (often utilizing Ukranian firmware), California recently joined the attempt to codify the right to repair into law. But that effort was derailed this week with the news that California's biggest farmer lobbying organization decided to sell out its constituents and support a watered down version of California's proposal.

Back in February, the Equipment Dealers Association promised a few concessions in a bid to stall legislation; including making repair manuals, diagnostic tech and other service tools widely available to farmers by 2021. They did not, however, address efforts to hamstring third-party part sales, the use of DRM to lock down devices, and continued to battle right to repair legislation in numerous states. The California Farm Bureau (which again is supposed to represent the farmers on this issue) this week struck a "concession" deal with the Equipment Dealers Association that isn't much of a concession.

In fact, said "new" concession closely mirrors things the industry had already voluntarily agreed to:

"It is beyond comprehension...why the California Farm Bureau—which should nominally have the interests of farmers in mind—reached an agreement with the Equipment Dealers Association last week that enshrines the concessions the Equipment Dealers Association already agreed to, without seemingly getting anything else out of it, and without even getting it to move up its 2021 timeline."

“This agreement is especially important because whenever we can resolve issues that concern us without passing laws, everybody wins,” Joani Woelfel, the CEO of the Far West Equipment Dealers Association, said in a statement.

Well, not everybody. The core problems here owners have grown angry about (DRM, intentionally making it harder for third-party repair shops to get parts) weren't really addressed, and the "compromise" not only isn't much of one, but it kills the California effort for effective right to repair laws. Needless to say, activists looking for more meaningful action see this as a massive sellout:

"When it is up to the manufacturer to decide what information to share and what to withhold, you haven't addressed the problem," Gay Gordon-Byrne, Executive Director of the Repair Association, which is leading the right to repair movement, told Motherboard in an email. "We're also concerned that the agreement fails to mention anything about fair and reasonable pricing for parts, nor any mention of how farmers will get firmware, updates or patches."

"This agreement does not end monopolization of farm equipment repair,” Nathan Proctor, who is heading consumer rights group US PIRG’s right to repair efforts, told me in an email. “While it highlights how industry is feeling the pressure from Right to Repair, it also underscores that we need to do more if truly want the freedom to fix our property."

Unfortunately for hardware vendors and companies like John Deere, this isn't a fight that's going to be going away any time soon. The tighter companies like John Deere lock down their products with draconian DRM and annoying restrictions on what consumers can do, the more activists they create who previously may have never even gotten involved in such fights. As it stands, there are pushes for right to repair laws in nearly 20 states, and the tighter these companies squeeze, the more support for these initiatives they generate.

Filed Under: california, california farm bureau, circumvention, copyright, digital locks, dmca, drm, farmers, right to repair
Companies: equipment dealers association, john deere

Amazon Joins Google In Making Censorship Easy, Threatens Signal For Circumventing Censorship Regimes

from the consequences dept

A couple weeks ago we wrote about the unfortunate decision by Google to stop enabling domain fronting on its AppEngine. As we explained at the time, this was an (accidental) way of hiding certain traffic by using the way certain large companies had set up their online services, such that censors in, say, Iran or China, couldn't distinguish which traffic was for an anti-censorship app, and which was for others. The two largest services that enabled this were Google and Amazon, and a variety of different anti-censorship tools made use of the ability to effectively "hide" within those sites such that an authoritarian government couldn't block their apps without blocking all of Google or Amazon or whatever. Some CDNs have admitted that they don't allow it out of a fear for how it could impact other users on the system, but on the whole it appeared to be a useful, if unintended, way for Google and Amazon to do good in the world.

However, when Google shut it down, the company just said that it was never supported, and the company had no plans to bring it back. Among the companies who relied on domain fronting is the popular encrypted communications app Signal. In a new blog post, Signal has explained why it believes Google suddenly decided to take action:

Direct access to Signal has also been blocked in Iran for the past 3+ years, but it was not possible to use the same domain fronting technique there. In an apparently unique interpretation of US sanction law, Google does not allow any requests from Iran to be processed by Google App Engine. Requests would get past Iranian censors, but then Google themselves would block them.

In early 2018, a number of policy organizations increased pressure on Google to change their position on how they were interpreting US sanction law so that domain fronting would be possible from Iran. Sadly, these lobbying efforts seem to have had the opposite effect. When Google’s leadership became more aware of domain fronting, it generated internal conversations about whether they wanted to put themselves in the situation of providing cover for sites that entire countries wished to block.

A month later, we received 30-day advance notice from Google that they would be making internal changes to stop domain fronting from working entirely.

That is... quite unfortunate. But, the story gets even worse. Because Signal then switched to Amazon, which resulted in the following chain of events:

With Google no longer an option, we decided to look for popular domains in censored regions that were on CloudFront instead. Nothing is anywhere near as popular as Google, but there were a few sites that used CloudFront in the Alexa top 50 or 100. We’re an open source project, so the commit switching from GAE to CloudFront was public. Someone saw the commit and submitted it to HN. That post became popular, and apparently people inside Amazon saw it too.

HN being Headline News. Amazon's response was even more stark than Google's. First, it sent Signal an email claiming that Signal was already violating its terms of service:

Yesterday AWS became aware of your Github and Hacker News/ycombinator posts describing how Signal plans to make its traffic look like traffic from another site, (popularly known as “domain fronting”) by using a domain owned by Amazon -- Souq.com. You do not have permission from Amazon to use Souq.com for any purpose. Any use of Souq.com or any other domain to masquerade as another entity without express permission of the domain owner is in clear violation of the AWS Service Terms (Amazon CloudFront, Sec. 2.1: “You must own or have all necessary rights to use any domain name or SSL certificate that you use in conjunction with Amazon CloudFront”). It is also a violation of our Acceptable Use Policy by falsifying the origin of traffic and the unauthorized use of a domain.

Signal points out, in response, that it's not actually violating Amazon's terms. It's not using security certificates from any other site, and it's not falsifying the origin of traffic when users get to Cloudfront (it's just tricking the censors in places like Iran). But, either way none of that matters much, because Amazon then announced that it was following Google's lead and killing domain fronting, claiming (again) that it doesn't want other Amazon cloud customers to find out that someone is effectively hiding behind their domain.

Signal admits that this more or less means the end of being able to use domain fronting to avoid censorship in heavily censored countries. It says it will look for alternative ideas, but in the meantime, this could do serious harm to people in those countries. There is, perhaps, a reasonable argument that we shouldn't have needed to rely on Google and Amazon as ways to hide traffic for important apps like Signal, but the fact that it was used for years this way really highlights how little damage domain fronting really seemed to do compared to the wider benefit.

With Google Cloud and AWS out of the picture, it seems that domain fronting as a censorship circumvention technique is now largely non-viable in the countries where Signal had enabled this feature. The idea behind domain fronting was that to block a single site, you’d have to block the rest of the internet as well. In the end, the rest of the internet didn’t like that plan.

We are considering ideas for a more robust system, but these ecosystem changes have happened very suddenly. Our team is only a few people, and developing new techniques will take time. Moreover, if recent changes by large cloud providers indicate a commitment to providing network-level visibility into the final destination of encrypted traffic flows, then the range of potential solutions becomes severely limited.

In short, this isn't a particularly good look. Google and Amazon made these moves so that people don't call them out for "protecting" apps like Signal by hiding their traffic behind the domains of totally uninvolved third-parties. Which certainly leaves both companies to being called out for favoring the interests of their customers over the interests of the public -- especially those in countries with authoritarian regimes. And, again, the "cost" to Google and Amazon was not high. No one was free riding, they were just doing a bit of misdirection to get around a censor's block. And now that's gone.

Filed Under: censorship, circumvention, domain fronting, signal
Companies: amazon, google, open whisper systems, signal

MPAA Opposes Several Filmmaker Associations Request For Expanded Circumvention Exemptions

from the not-our-film-studios dept

Over the past few weeks, we've mentioned in a couple of posts that the Copyright Office is currently taking public commentary for changes to the DMCA's anti-circumvention exemptions provisions. While we've thus far limited our posts to the Museum of Art and Digital Entertainment's bid to have those exemptions extended to preserving online video games and the ESA's nonsensical rebuttal, that isn't the only request for expanded exemptions being logged. A group of filmmaker associations put in a request last year for anti-circumvention exemptions to be extended to filmmakers so that they can break the DRM on Blu-ray films in order to make use of clips in new works. At issue is the fact that these filmmakers are able to make use of clips in these new works thanks to fair use but cannot readily get at them due to the DRM on the films themselves.

This is confusing and creates uncertainty, according to the International Documentary Association, Kartemquin Films, Independent Filmmaker Project, University of Film and Video Association, and several other organizations. Late last year they penned a submission to the Copyright Office, which is currently considering updates to the exemptions, where they argued that all filmmakers should be allowed by break DRM and rip Blu-rays. The documentary exemptions have been in place for years now and haven’t harmed rightsholders in any way, they said.

“There is no reason this would change if the ‘documentary’ limitation were removed. All filmmakers regularly need access to footage on DVDs and without an exemption to DVDs, many non-infringing uses simply cannot be made,” the groups noted.

So, there are several groups that lobby for documentarians going to bat for the larger filmmaking world, having seen just how beneficial the exemptions they enjoy have been to the documentary craft. Frankly, it's nice to see associations such as these not simply staying in their own lane and instead advocating for their larger craft as a whole. Unlike, say, the MPAA which leapt to respond with claims of how awful all of this would be.

A group of “joint creators and copyright owners” which includes Hollywood’s MPAA, the RIAA, and ESA informs the Copyright Office that such an exemption is too broad and a threat to the interests of the major movie studios.

The MPAA and the other groups point out that the exemption could be used by filmmakers to avoid paying licensing fees, which can be quite expensive.

Which, of course, is precisely the point of these exemptions. An end-around of fair use by locking up content behind DRM in order to extract licensing fees from those that legally would otherwise not have to pay them is a special kind of perversion of the DMCA. Not to mention copyright law as a whole, actually. Recall that the entire purpose of copyright law in America is to promote the creation of more works for public consumption. What the MPAA is arguing is that these exemptions, which would do much to promote new work, should be cast aside in favor of a system in which those new works live at the pleasure of the licensing schemes of the major movie studios. Unlike the group petitioning for the exemptions, the MPAA isn't even bothering to hide who's interests it cares about.

If the filmmakers don’t have enough budget to license a video, they should look for alternatives. Simply taking it without paying would hurt the bottom line of movie studios, the filing suggests.

“Many filmmakers work licensing fees into their budgets. There is clearly a market for licensing footage from motion pictures, and it is clear that unlicensed uses harm that market.

“MPAA members actively exploit the market for licensing film clips for these types of uses. Each year, MPAA member companies license, collectively, thousands of clips for use in a variety of works,” the group writes.

The Copyright Office has limited the exemption to the documentary genre for a good reason, the creators argue, since non-documentaries are less likely to warrant a finding of fair use.

Except, thanks to the silliness of reserving fair use as an affirmative defense rather than a clearly defined statute, whether a use qualifies as fair use or not is a question to be answered after the use, not before. And that question isn't a valid reason to lock up content behind DRM from filmmakers that could make fair use of it.

The MPAA goes on to suggest that if the Copyright Office and the Librarian of Congress were to allow these exemptions, it would lead to "widespread hacking" that would ultimately defeat the DRM in Blu-ray discs entirely. Limiting the exemption to documentaries has kept this from happening because the documentary market is smaller. None of that, however, serves as a true copyright argument and instead is, again, all about the licensing fees Hollywood is able to extract by locking up content on discs behind DRM.

It is nice of the MPAA to lay its loyalties bare for all to see, however -- major movie studios and nobody else, it seems.

Filed Under: circumvention, clips, copyright, dmca, dmca 1201, drm, fair use, filmmakers
Companies: mpaa

Tim Berners-Lee Sells Out His Creation: Officially Supports DRM In HTML

from the this-is-bad dept

For years now, we've discussed the various problems with the push (led by the MPAA, but with some help from Netflix) to officially add DRM to the HTML 5 standard. Now, some will quibble with even that description, as supporters of this proposal insist that it's not actually adding DRM, but rather this "Encrypted Media Extensions" (EME) is merely just a system by which DRM might be implemented, but that's a bunch of semantic hogwash. EME is bringing DRM directly into HTML and killing the dream of a truly open internet. Instead, we get a functionally broken internet. Despite widespread protests and concerns about this, W3C boss (and inventor of the Web), Tim Berners-Lee, has signed off on the proposal. Of course, given the years of criticism over this, that signoff has come with a long and detailed defense of the decision... along with a tiny opening to stop it.

There are many issues underlying this decision, but there are two key ones that we want to discuss here: whether EME is necessary at all and whether or not the W3C should have included a special protection for security researchers.

First, the question of whether or not EME even needs to be in HTML at all. Many -- even those who dislike DRM -- have argued that it was kind of necessary. The underlying argument here is that certain content producers would effectively abandon the web without EME being in HTML5. However, this argument rests on the assumption that the web needs those content producers more than those content producers need the web -- and I'm not convinced that's an accurate portrayal of reality. It is fair to note that, especially with the rise of smart devices from phones to tablets to TVs, you could envision a world in which the big content producers "abandoned" the web and only put their content in proprietary DRM'd apps. And maybe that does happen. But my response to that is... so what? Let them make that decision and perhaps the web itself is a better place. And plenty of other, smarter, more innovative content producers can jump in and fill the gaps, providing all sorts of cool content that doesn't require DRM, until those with outdated views realize they're missing out. Separately, I tend to agree with Cory Doctorow's long-held view that DRM is an attack on basic computing principles -- one that sets up the user as a threat, rather than the person who owns the computer in question. That twisted setup leads to bad outcomes that create harm. That view, however, is clearly not in the majority, and many people admitted it was a foregone conclusion that some form of EME would move forward.

The second issue is much more problematic. A bunch of W3C members had made a clear proposal that if EME is included, there should be a covenant that W3C members will not sue security researchers under Section 1201 of the DMCA should they crack any DRM. There is no reason not to support this. Security researchers should be encouraged to be searching for vulnerabilities in DRM and encryption in order to better protect us all. And, yet, for reasons that no one can quite understand, the W3C has rejected multiple versions of this proposal, often with little discussion or explanation. The final decision from Tim Berners-Lee on this is basically "sure a covenant not to sue would have been nice, and we think companies shouldn't sue, but... since this wasn't raised at the very beginning, we're not supporting it":

We recommend organizations involved in DRM and EME implementations ensure proper security and privacy protection of their users. We also recommend that such organizations not use the anti-circumvention provisions of the Digital Millennium Copyright Act (DMCA) and similar laws around the world to prevent security and privacy research on the specification or on implementations. We invite them to adopt the proposed best practices for security guidelines [7] (or some variation), intended to protect security and privacy researchers. Others might advocate for protection in public policy fora – an area that is outside the scope of W3C which is a technical standards organization. In addition, the prohibition on "circumvention" of technical measures to protect copyright is broader than copyright law's protections against infringement, and it is not our intent to provide a technical hook for those paracopyright provisions.

Given that there was strong support to initially charter this work (without any mention of a covenant) and continued support to successfully provide a specification that meets the technical requirements that were presented, the Director did not feel it appropriate that the request for a covenant from a minority of Members should block the work the Working Group did to develop the specification that they were chartered to develop. Accordingly the Director overruled these objections.

This is unfortunate. What's bizarre is that the supporters of DRM basically refuse to discuss any of this. Even just a few days ago, the Center for Democracy and Technology proposed a last-ditch "very narrow" compromise to protect a limited set of security and privacy researchers (just those examining implementations of w3C specifications for privacy and security flaws.) Netflix flat out rejected this compromise saying that it's "similar to the proposal" that was made a year ago. Even though it's not. It was more narrowly focused and designed to respond to whatever concerns Netflix and others had.

The problem here seemed to be that Netflix and the MPAA realized that they had enough power to push this through without needing to protect security researchers, and just decided "we can do it, so fuck it, let's do it." And Tim Berners-Lee -- who had the ability to block it -- caved in and let it happen. The whole thing is a travesty.

Corry Doctorow has a thorough and detailed response to the W3C's decision that pushes back on many of the claims that the W3C and Berners-Lee have made in support of this decision. Here's just part of it:

We're dismayed to see the W3C literally overrule the concerns of its public interest members, security experts, accessibility members and innovative startup members, putting the institution's thumb on the scales for the large incumbents that dominate the web, ensuring that dominance lasts forever.

This will break people, companies, and projects, and it will be technologists and their lawyers, including the EFF, who will be the ones who'll have to pick up the pieces. We've seen what happens when people and small startups face the wrath of giant corporations whose ire they've aroused. We've seen those people bankrupted, jailed, and personally destroyed.

This was a bad decision done badly, and Tim Berners-Lee, the MPAA and Netflix should be ashamed. The MPAA breaking the open internet I can understand. It's what that organization has wanted to do for over a decade. But Netflix should be a supporter of the open internet, rather than an out and out detractor.

As Cory notes in his post, there is an appeals process, but it's never been used before. The EFF and others are exploring it now, but it's a hail mary process at this point. What a shame.

Filed Under: circumvention, copyright, dmca, drm, eme, html, html 5, research, security, tim berners-lee
Companies: mpaa, netflix, w3c

Portugal Pushes Law To Partially Ban DRM, Allow Circumvention

from the straight-to-the-Priority-Watch-list-naughty-step-for-you dept

You might think that copyright on its own has enough problems. And yet DRM, originally designed to protect digital copyright material from unauthorized copying, has managed to make things much worse. It not only punishes with extra inconvenience those who acquire legal copies -- but not those who manage to find illegal versions without DRM -- it also allows the DMCA to be used to disable competitors' products, to create repair monopolies, and even to undermine the very concept of ownership. You can see why the copyright industry really loves DRM, and fights to preserve its sanctity. And you can also see why the following news from Portugal, where the parliament has just approved a bill allowing DRM circumvention and even bans in certain situations, is such a big deal. As TorrentFreak reports:

The bill, which received general approval last December, tackles the main issues head-on by granting copying permission in some circumstances and by flat-out banning the use of DRM when the public should have right of access to a copyrighted work.

In a boost to educators, citizens will be given the right to circumvent DRM for teaching and scientific research purposes. There will also be an exception for private copying.

The draft also outlaws the use of DRM on copyright works that have fallen into the public domain, works which support cultural heritage, and works that were created by public entities or funded with public money.

Those are all eminently sensible restrictions on DRM, but they are likely to be met with howls of anger by the copyright maximalists if Portugal's president approves the law, as seems likely. That's because it would set a crucial precedent for allowing DRM to be circumvented legally, and establish that DRM can be completely forbidden in some situations. As a result, we can probably expect Portugal to be punished in the traditional manner: by being placed on the ridiculous "Priority Watch" list of the USTR's Special 301 report. If that does happen, let's hope Portugal follows Canada's lead, and treats the move with the contempt it deserves.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: circumvention, copyright, drm, portugal